The Israeli security company Vega is launching Vega II. This is the platform’s biggest update since the company emerged from stealth mode a year ago. The new version features its own AI model trained for cyber defense. Vega is also introducing a memory layer and a gateway that provides access to data sources without traditional pipelines.
Vega positions itself as an alternative to traditional SIEMs. The platform analyzes security data where it resides, so organizations don’t have to move everything to a single central environment first. With Vega II, the company is taking it a step further. Detection, triage, and investigation now run as an autonomous loop of AI agents, which security analysts control.
According to the company, this is necessary because attackers are already deploying new frontier models within the week of their release. Meanwhile, defenders use generic AI that starts its reasoning process from scratch with every alert. “AI gave attackers a head start. It doesn’t have to give them the future,” says CEO Shay Sandler.
That conviction is at the company’s core. Sandler founded Vega in 2024 together with Eli Rozen. The company emerged from stealth mode in September 2025 with $65 million in funding, at a valuation of $400 million.
Three building blocks
The most striking component is Vega’s first in-house model. The model has been post-trained for agentic cyberdefense and operates within the platform alongside state-of-the-art models from other providers. Vega emphasizes speed: the model must reach a decision while generic AI is still processing. This ensures that every alert receives an expert-level assessment, even at volumes where a team would never have enough people.
The second component is called Vega Memory. Knowledge gained from an investigation is often lost as soon as a ticket is closed. Vega Memory therefore records the environment’s actual state and the actions taken, so the next assessment builds on what the team already knows. Engineers can view, review, and determine for themselves what is stored. For security teams that don’t want to blindly trust AI, this isn’t a luxury.
The third component is Vega Gateway. This component streams data sources via OpenTelemetry, webhooks, or APIs to low-cost object storage, without complex pipelines or legacy connectors. Sources that previously had nowhere to go are now also covered by Vega’s in-place analytics. According to the company, onboarding should take a few minutes.
Tip: Check Point acquires cloud security startup Dome9 Security